Ho, ho, ho! The Cure53 XSSMas Challenge 2016 is here!

Welcome to the toughest XSSMas challenge to date. And welcome to the erm.. jailbreak community!

While our community already isn't low on folks breaking jails of varying relevance, this time we actually have a serious request for you! Help Santa!

This time, Santa really needs your help. He completely overdid it with eggnog and reindeer-dust and well, they arrested him and locked him up real good. What does that mean? No gifts this year, that's what it means. But you can help!

Santa got locked up in a cyber-prison close to the south pole and only your skills can bust him out and save XSSMas. Are you willing to do it?
Are you ready to go all-in for Santa? Let's sure do hope so! Santa made a lot of ka-ching by selling reindeer-dust - he will reward you generously!

You?

But Santa, oh Santa, what are the rules?

The key to free Santa resides on juicyfile.cure53.de. You need to retrieve it from your safe-zone on xssmas2016.cure53.de and alert it to free him from prison! Don't use any other origin than xssmas2016.cure53.de - it's not safe out there!

The utilization of user interaction is not allowed. Not at all. No click, no mouse-over, no focus, no nothing.

The solution must work in an up-to-date browser like Chrome 55+, Firefox 50+, Safari 10+ and Edge 14+. No IE11, no browser older than the current stable release.

The first valid submission will earn you a 500 EUR cash prize! Be quick!

The shortest valid submission (at the moment the challenge ends) will earn you a 1000 EUR cash prize! Be smart!

The challenge ends on 31st of January 2017, 20:17 CET (that's 8:17pm)

And lastly, as usual, we make the rules, we decide, we reserve the right to fail and re-decide if it helps the challenge. Yes means yes and no means no. There will be no discussions.

Now, what am I supposed to do to avoid becoming reindeer fodder?

Fetch the key and alert it. This frees Santa. Watch out for maybe even more hidden tasks.

Watch out for hints here and there, think outside the box.

You cannot solve this challenge by brute-force. Stop your scanner, save a tree.

Don't try to social-engineer us like folks tried last year. We will be extra careful now, John!

Revisit the most interesting techniques published in 2016 and see if they apply here.